How to Block Traffic by Country with CSF in WHM

What is this for?

CSF is a firewall add-on for servers that run WHM, the admin panel for the whole server. A firewall is a guard that decides who may enter. CSF can block whole countries. It does this with country codes. A country code is a two-letter short name, like US for the United States or IN for India.

Some people block countries where they have no customers but see many attacks.

Warning: Blocking a country also blocks real visitors from there. It may block search engine bots or payment services. Take a backup of your CSF settings first. Do not block your own country.

Before you start

• You need root access.
• CSF must be installed. Ask Hostvento support if you are not sure.
• You need a free MaxMind GeoLite database, which CSF uses to know where an IP address is from. Newer versions of CSF may ask you to add a MaxMind licence key in the settings.

Steps

1. Log in to WHM as root.

   

2. Type CSF in the search box.
3. Click ConfigServer Security & Firewall.

   

4. Click Firewall Configuration.

   

5. Find the section named Country Code Lists and Settings.
6. Find CC_DENY. Type the country codes to block, separated by commas. For example CN,RU.

   

7. Check the setting CC_ALLOW_FILTER if you want the opposite. It lets only the listed countries in.
8. Set CC_LOOKUPS to the option that suits you, as the page explains.
9. Scroll down and click Change.
10. Click Restart csf+lfd.

Check that it works

On the CSF page, use Search for IP. Type an address from the blocked country. CSF should say it is blocked.

Allow one IP address from a blocked country

1. On the CSF page, click Firewall Allow IPs.
2. Add the IP address on a new line.
3. Click Change.

This lets that one visitor in even if the country is blocked.

Quick recap

• CSF can block countries using two-letter codes.
• Edit CC_DENY in Firewall Configuration.
• Save with Change and restart csf+lfd.

  

• Back up settings and never block your own country.
• Use the allow list for exceptions.